CVE-2014-9658

freetype: buffer over-read and integer underflow in tt_face_load_kern()

Published Feb 8, 2015 CVSS 2.0 · 7.5 High EPSS 5.1% KEV · Not listed
Description
The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-185-1 freetype security update
Debian DSA Debian DSA DSA-3188-1 freetype security update
EUVD EUVD EUVD-2014-9468 The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font.
Ubuntu USN Ubuntu USN USN-2510-1 FreeType vulnerabilities
History
Type Values Removed Values Added
Metrics epss

{'score': 0.01898}

epss

{'score': 0.01279}